XRP Ledger issues urgent security hotfix

TLDR

XRP Ledger (XRP) has shipped an urgent xrpld 3.2.1 hotfix to neutralize a validator manifest flood bug without disrupting consensus or user funds.

1. xrpld 3.2.1 adds strict limits on validator manifest size and propagation to stop a resource-draining flood attack.
2. The incident stressed node infrastructure but did not alter transactions or cause financial loss, and ordinary XRP holders do not need to take action.
3. Node operators are urged to upgrade and restart quickly, with a deeper post mortem and a larger 3.3.0 upgrade expected next.

Deep Dive

1. What The Hotfix Changes

Ripples Director of Engineering urged all XRP Ledger node operators to upgrade to xrpld 3.2.1 after a validator manifest flood was observed on 31 July 2026. Reports say nodes previously accepted, stored, and rebroadcast unlimited manifests from unknown validator keys, which could overwhelm resources and persist after restarts.

The 3.2.1 hotfix introduces four key safeguards: a size cap per manifest, a receive cap that drops oversized batches while keeping connections, a send cap on bulk manifest greetings, and a cache cap that limits unknown validator identities to 100. Manifests from unknown keys are no longer written to disk, further containing the attack surface, as detailed in the urgent XRPL update advisory and a complementary crypto.news report.

2. Impact On Users And Infrastructure

During the manifest flood incident, node resources and peer to peer communications were pressured, but XRP Ledger continued closing ledgers normally, with no change to transaction ordering and no reported financial loss according to crypto.news. No CVE or loss estimate has been published so far.

The advisory explicitly targets infrastructure: exchanges, custodians, wallet back ends, data providers, and businesses running XRPL servers. Ordinary XRP holders do not need to move funds or rotate keys because the exploit focused on validator identity gossip rather than account balances or signing keys.

Risk remains mostly operational for lagging nodes: servers that do not upgrade could be more vulnerable to future floods or become misaligned once the network assumes the new limits.

3. What To Watch Next

Operators are instructed to upgrade to xrpld 3.2.1, confirm the daemon is running, then restart again so persisted unknown manifests are cleared. Ensuring trust in Ripples current package signing key is also part of the process. Adoption speed across major exchanges and infrastructure providers is the key near term metric.

Separately, XRP Ledger is preparing a broader xrpld 3.3.0 release that restores rewritten Batch and Permission Delegation amendments and adds other enterprise and tokenization features. Validators previously blocked the original versions after researchers found flaws that could have drained accounts via fees, as described in a technical explainer.

Conclusion

The urgent XRPL hotfix is a serious, but contained, infrastructure event: it hardens validator identity handling against flood attacks without touching user balances or transaction integrity.

For crypto users, the main takeaway is that XRPs security story is playing out at the node and amendment level; what matters now is how quickly major validators and venues adopt 3.2.1 and, later, 3.3.0, and whether future audits keep catching issues before they reach mainnet.